i would like to switch to a custom rom (either graphene or linneage) but i'm scared of by the fact that i can't close the bootloader afterwards. i don't want to make it too easy for anyone to get into my phone.
how severe is this issue and are there any workarounds? could i encrypt my phones data in a way that its still usable?
Posted Jul 13, 2022, 8:21 PM UTC
Graphene supports relocking the bootloader, but its only available for pixel phones.
Try Calyx if you don't have a pixel, it supports relocking the bootloader too
afaik calyx pretty much only supports pixels as well. i want to get one as my next phone but for now i'm stuck with something else
I am waiting until the pixel 7 drops (supposedly this fall), to buy a 6 for maybe a bit cheaper.
oooh, that's good to know. thx :)
but for now i'm stuck with something else
is it privacy focused?
nope. but i don't want to throw it away while it still works extremely well. a custom rom is the best i can currently do
You're supposed to lock the bootloader after installing GrapheneOS, infact its one of the installation steps in their guide so not sure why you're scared that you can't.
Sources:
okay, my bad. i thought graphe ran on other devices than pixels but i was misinformed.
i don't have a pixel. i know those can relock their bootloader but my current phone can't. i guess my only option would be lineageOS then...
Ahh thats a shame, lineageos is still a great option and im pretty sure you should be able to lock the bootloader after installation although you'd have to check the official guide as im not as familiar with lineage as i am with graphene, good luck on your ventures though!
divestos supports re locking on some devices
I'm no android expert but as I understand it the biggest issue with not locking your bootloader is that someone could theoretically "modify" the OS of the phone. If you have full device encryption enabled then exposure of your data should not be a risk. And if the full device encrypts then modification of the OS is not really an issue as much as a full re-installation of a new OS is. So the only attack I could see under those circumstances that would result in exposure of your data involves someone flashing a modified rom to the phone that is close enough to your current installation to fool you into entering sensitive information while you are in the compromised environment. That would probably require them to have a copy of your phones data beforehand to craft the compromised rom though, and as stated before all that stuff could be encrypted already, thereby thwarting that possible vector of attack. Can't replicate something you cant see. The most realistic threat of having an unlocked bootloader would be that a thief could take your phone and flash the stock rom back onto it to resell, where a locked bootloader would prevent this. There could be other attacks I'm not aware of here, but with the main OS and data of the phone encrypted the possibilities begin to veer into the realm of hypothetical, sophisticated, and targeted attacks.
I would say that the question of whether you should unlock your bootloader has more to do with your threat model than anything. Does someone want your data so much that they are willing to get physical access to your device and perform a relatively sophisticated attack on it? If not then you will likely be fine so long as you are taking advantage of full device encryption.
I could be completely off-base though. That's just how I remember it being explained to me a while ago. I don't have the personal experience under the hood with android phones to say that definitively. Just an anecdote from someone who did a little research about bootloaders after hearing about graphene/calyx for the first time.